sova | 6f7e57ed7239905fafc3947160b5fc89ad615772d2a694299999d2fe080453f4

Analysis

max time kernel
3132657s
max time network
21s
platform
android_x86
resource
android-x86-arm-20220823-en
resource tags

androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system
submitted
07-03-2023 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aras_Kargo.apk
Size

4.9MB
MD5

763392481eb7481b63f34271168821cb
SHA1

d6fc3b5cc2e8a4964c4858fd515e9566e28aa29e
SHA256

6f7e57ed7239905fafc3947160b5fc89ad615772d2a694299999d2fe080453f4
SHA512

db372e0d80f99ef6466aba2f3f1a84f0d712195b2bf23eedce2318330072e4dea531e520d41540f7b3cdc3803f54bd3c24bc074163f78615e54808756534cdbe
SSDEEP

98304:Av+dv9EEgB0Nbb3EX4cgY0RDNHApXnUdBtE6F428QdWET4CfhjCzOSr:AvC9AB0NvEXjMNHanMBtEM4cT4Cfoh

Score

10^/10

sova banker infostealer trojan

Malware Config

Signatures

SOVA_v5 payload 2 IoCs

Processes:

resource	yara_rule
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json	family_sova_v5
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json	family_sova_v5

Sova
Android banker first seen in July 2021.
banker trojan infostealer sova
Acquires the wake lock. 1 IoCs

Processes:

com.armed.little

description ioc process

Framework service call android.os.IPowerManager.acquireWakeLock com.armed.little

description	ioc	process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.armed.little

Loads dropped Dex/Jar 2 IoCs

Runs executable file dropped to the device during analysis.

Processes:

/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.armed.little/app_DynamicOptDex/QM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.armed.little/app_DynamicOptDex/oat/x86/QM.odex --compiler-filter=quicken --class-loader-context=&com.armed.little

ioc	pid	process
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json	4190	/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.armed.little/app_DynamicOptDex/QM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.armed.little/app_DynamicOptDex/oat/x86/QM.odex --compiler-filter=quicken --class-loader-context=&
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json	4130	com.armed.little

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

48 ip-api.com

flow	ioc
48	ip-api.com

com.armed.little
1⤵
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4130
- /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/com.armed.little/app_DynamicOptDex/QM.json --output-vdex-fd=41 --oat-fd=42 --oat-location=/data/user/0/com.armed.little/app_DynamicOptDex/oat/x86/QM.odex --compiler-filter=quicken --class-loader-context=&
  2⤵
  - Loads dropped Dex/Jar
  PID:4190

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/data/user/0/com.armed.little/app_DynamicOptDex/QM.json

Filesize
2.2MB

MD5
381703c39f515d4cb60ae5d127a2389d

SHA1
6545b645ac0f7a9ebfff67f270cdb6bf652200f9

SHA256
ae0cfd99a0933a05df6b9557f28e8618b9c7b1d3c298093e16dcb0b0f5b544e5

SHA512
744fba04a9899a0352b660a28980b2375c1e90588cc84eea00909b3e445e0db4d61b7d66d51a6d54f1b21daceab75f55cf52d6fe1e7727c2114cf509ffad6426

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json

Filesize
6.2MB

MD5
50ff812290e5d675002bba8064a6dfaa

SHA1
9e845866040dbe6c9eebaeb3a45f7395337aead8

SHA256
44dd6c0d8f77b816be42c905b0a3d4b286af423d740a4967d696ff5792da14ea

SHA512
1df5ff7d2a9aa1142a6a4ff9d58a890d021e8c916617251210b96bc2b414f5da6c2b566754d89001edccb21679b67a05f50195bf49288790bb77c32774d7ee7c

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json

Filesize
6.2MB

MD5
612f6053455f37c445e74a7e7aba3622

SHA1
1626be734fd1bb5af4f54a4d71c80728971a9f58

SHA256
a49f395860461531fd85ae829c6d3ac1eb236ac79d42fd41e6247c57599f4557

SHA512
a37ccb1aff40a487d90aa6ca0df2121df1882ffe40850e69f9fa01513726728c0e1a2e74c3a3a5b53a4b476e5e1a008b62e5d7866dd9719ee1ffc8d463c380d8

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/QM.json.x86.flock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/oat/QM.json.cur.prof

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/oat/x86/QM.odex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_DynamicOptDex/oat/x86/QM.vdex

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_webview/metrics_guid

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_webview/metrics_guid

Filesize
36B

MD5
5b72d0ed5bdaf1503ada09af320c25ab

SHA1
2461d0eb8233b9b5613fe136029b3f0891283310

SHA256
bfe1f085e579313cbf8490ccec3a4ad4f4bac221d692a7d46601764abc571c60

SHA512
09d578c49d1f6b1364a5fdabf430c53e8559c69dfba93a35dd2886efd153a3e0321d9fa731c7b301776a6f72d9adbf22c2c064d1deca0ef46f2640c92d7910f6

Download Submit
/data/user/0/com.armed.little/app_webview/variations_seed_new

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_webview/variations_stamp

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/app_webview/webview_data.lock

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/data/user/0/com.armed.little/no_backup/androidx.work.workdb

Filesize
4KB

MD5
f2b4b0190b9f384ca885f0c8c9b14700

SHA1
934ff2646757b5b6e7f20f6a0aa76c7f995d9361

SHA256
0a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514

SHA512
ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1

Download Submit
/data/user/0/com.armed.little/no_backup/androidx.work.workdb-journal

Filesize
524B

MD5
245c691a0d2b965914691f97c21ce345

SHA1
4ee41f40f745db6fcbcc267eabe0e1eba5ab9dba

SHA256
c21e7f1791b319f35a1ce5c0311ae3363a255f5717c789b5fcbde3a9621e9a48

SHA512
988131f1f8a259a2951c5edbb546ebd4f1a29f36c1ee2bf13b060432a69d5c065cacd78ba21c218861e416d7041899cad23c83f942dfe365bb05191bf772f68b

Download Submit
/data/user/0/com.armed.little/no_backup/androidx.work.workdb-shm

Filesize
8B

MD5
7dea362b3fac8e00956a4952a3d4f474

SHA1
05fe405753166f125559e7c9ac558654f107c7e9

SHA256
af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc

SHA512
1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

Download Submit
/data/user/0/com.armed.little/no_backup/androidx.work.workdb-wal

Filesize
177KB

MD5
bf9b0702fe7c05e800fef1ee969925df

SHA1
51611a23f518346aa1531c63b2de0fe38370847a

SHA256
f95c48bc040bf0d047489032ecd3ac2a89874dcf5373b7cbf3a29a7113971bd7

SHA512
6258ec325ec8a291d8f5988abb03bfba5bac86bbc99ca4ce93a3754d85a6d40a59136142c676c595e9d31799e8bf0abfe45753953dbc3563d5d9a89d254206bc

Download Submit
/data/user/0/com.armed.little/shared_prefs/WebViewChromiumPrefs.xml

Filesize
127B

MD5
21223e9184445fe043476484cd8cb1f9

SHA1
2b4813f849121d60ba35eb0889080668bb62c778

SHA256
bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af

SHA512
be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

Download Submit